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^ . I. INTRODUCTION 

>->' 

' Computing whether two binary strings are equal or not is an important task that can be used to protect software, or 
used as a primitive for authentication. Unfortunately the comparison of two objects, such as two operating systems, 
may be expensive when the entire message strings that identify these objects must be transmitted over large distances. 
Fingerprinting allows a significant reduction in communication costs when a small likelihood of error in the comparison 
CO i is acceptable. Then, rather than transmitting the entire message string for the object itself, a relatively shorter string, 
or fingerprint, that identifies the object is sent. Although errors may arise in the comparison of fingerprints, this error 
can be made sufficiently small by simply increasing the fingerprint length. 
^ • The key question concerned with fingerprinting is, for given message and fingerprint lengths, what is the minimum 
'', achievable guaranteed error rate? In this article we partially answer this question for fingerprinting protocols described 
■ within Yao's simultaneous message passing model of communication complexity P, The fingerprints are then 
T-H ' generated and transmitted by two parties, Alice and Bob, who are forbidden direct communication, but instead 

. allowed to correspond with a referee known as Roger, 
•n ' Our fingerprinting scenario is described as follows (see Fig^). A supplier, who we call Sapna, chooses two messages, 
, X and y, from a pool of n unique messages and hands them to Alice and Bob, respectively. As communication is 
' considered expensive, Alice and Bob arc limited to sending fingerprints of their original messages to Roger, a and h 
Oh! respectively, which they select from a smaller pool of size m. Roger then infers 

|: EQ(.,,) = {J; ll^l , (1) 

' and completes the protocol by reveahng a single bit z £ {0, 1}. Roger is correct if z = EQ{x,y). In the current 
^ : investigation we consider one-sided-error protocols, in which case, z = only if a; ^ y. One-sided-error protocols are 
of vital practical importance whenever the 'cost' of false negative results exceeds that of false positives. 

The fingerprinting protocol adopted by Alice, Bob and Roger is publicly announced. The goal of this protocol is to 
' minimize Roger's error probability. Sapna, however, may be a saboteur, and always choose message pairs that lead 
to the highest rate of error in Roger's output. We thus evaluate fingerprinting protocols according to this worst-case 
scenario. The worst-case error probability, Pwcc = max2:,yPr(z 7^ EQ(x,j/)), then corresponds to the maximum error 
rate of the protocol. 

In the private-coin model, each party is handed a coin to generate private randomness. This gives Alice and Bob 
the ability to probabilistically avoid message collisions, in which different messages produce the same fingerprint. In 
the following we analyze the public-coin model, for which an additional source of randomness is made available, in 
the form of a secret key generated by a public coin, to be shared by Alice and Bob, but kept hidden from Sapna. One 
way to hide the key from Sapna is for Alice and Bob to use only those public-coin outcomes that have arisen after 
Sapna has dealt the messages. 

There has been recent interest in quantum analogues of fingerprinting protocols 0, S IE IE S 13 • Whereas classical 
fingerprints are length log2 m bit strings, quantum fingerprints are states in an m-dimensional Hilbert space, or 
equivalcntly, log2 m qubit strings. Furthermore, in the quantum regime, shared randomness is replaced by shared 
entangled states. The seemingly more general case of Alice and Bob sharing both entanglement and randomness 
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FIG. 1: The communication flow diagram for flngerprinting with a shared random key 5. 



is not necessary: Alice and Bob may always generate shared randomness from shared entanglement through local 
measurements. 

It has been shown in the asymptotic limit that, when shared randomness (or entanglement) is forbidden, fingerprints 
composed of quantum information can be made exponentially smaller than those composed of classical information. 
Specifically, for messages of length = logj n bits, in the classical case it is sufficient and necessary for Alice and Bob 
to communicate fingerprints of length 0{Vn) bits if the error is to be kept arbitrarily small 0,0,^3- If however, the 
parties communicate fingerprints constructed from quantum bits, only 0(log A") many are needed This definitive 
resource advantage does not exist when a shared key is allowed, in which case, fingerprints of length 0(1) bits/qubits 
are now sufficient [HlsllTH. Here we derive an analytic bound, however, that quantum fingerprinting protocols must 
surpass in order to claim an y a dvantage over classical protocols. Such bounds are important for experimental tests of 
quantum fingerprinting [l3Lll4j . 

We show that, for classical fingerprinting protocols with one-sided error and an arbitrary amount of shared ran- 
domness, the minimum achievable worst-case error probability is 

fc[n/m]^ + (m — fc)[n/mj^ — n 
n'^ — n 

(k ^ n mod m) when n > m, and otherwise. Quantum fingerprinting protocols with an arbitrary amount of shared 
entanglement, on the other hand, are shown to attain worst-case error probabilities of 

n/m^ - 1 

when n > m^, and otherwise. The difference between the two error rates is made clear when m divides n, in 
which case the classical error probability reduces to (n/m — l)/(n — 1). It is interesting that the addition of shared 
entanglement in the quantum case allows perfect error-free fingerprinting protocols to be constructed when m < n. 
In the limit of large message numbers, n — > 00, the classical error probability Q tends to 1/m whereas the quantum 
error probability Q approaches 1/w?. Thus, in the asymptotic limit, some improvement of quantum fingerprinting 
protocols over classical protocols still exists in the presence of shared randomness or entanglement. We now begin 
our analysis by considering classical fingerprinting protocols. 



II. CLASSICAL STRATEGIES WITH SHARED RANDOMNESS 



We first present a simple protocol which achieves the bound [Eq. In each round of fingerprinting, Alice and Bob 
use their shared random key to partition the set of n messages into m groups of almost equal size: k groups containing 
[n/m] messages, and m — k groups containing [n/m\ messages {k ^ n mod m). This partition is identical for Alice 
and Bob, but given the randomness of the key, is completely unknown to Sapna. Upon receipt of the messages, Alice 
and Bob generate fingerprints according to which group they belong to. Roger then infers equality if and only if the 
fingerprints he receives are identical i.e. the messages belong to the same group. 
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In this protocol, the worst-case scenario occurs when Sapna chooses unequal message pairs belonging to the same 
group. Sapna has k \n/m] ^ + {m — k) \ n/m\ ^ — n choices from a total oi m? — n unequal message pairs, but not being 
privy to how the messages are grouped, she is instead compelled to send random pairs of unequal messages. The 
worst-case error rate is thus given by the ratio of these two numbers [Eq. Q]. Note that the protocol is implemented 
without any need for private randomness. The remainder of this section is dedicated to proving that it is indeed 
optimal. 

It will prove useful to think of Alice, Bob and Roger as a team with the shared goal of maximizing Roger's 
probability of success, and Sapna operating as their opponent. This team has a pre-established, publicly known 
strategy. In this strategy, Alice and Bob have a probability of communicating each fingerprint pair (a, b) to Roger 
for a given message pair {x,y) provided by Sapna. Furthermore, in this strategy, Roger has a fixed probability of 
declaring x and y to be the same message upon receipt of fingerprint pair (a, b) provided by Alice and Bob. Any 
strategy is completely specified by a triple of functions (p, g, r), where p,q : {1, . . . , m} x {1, . . . , n} x Z+ [0, 1] 
and r : {1, . . . , to} x {1, . . . , m} [0, 1]. The function p{a\x, ^) is the probability that Alice sends fingerprint a to 
Roger, given that she receives message x from Sapna and shares the random key ^ with Bob. Similarly, q{b\y,^) is 
the probability that Bob sends b to Roger, given that he receives y from Sapna and shares ^ with Alice. The function 
r(a, b) is the probability that Roger outputs z = 1, given that he receives fingerprint a from Alice and b from Bob. 

When a party's private strategy (p, q or r) takes values only in the set {0, 1}, we call that party's strategy 
deterministic. If all parties' strategies are deterministic we call the triple (p, q, r) a deterministic strategy. Otherwise 
a general (i.e. probabilistic) strategy should be assumed. Normalization requires 

m m 

^p(a|x,C)=^g(%,e) = l (4) 

a=l 6=1 

for all X, y and ^. 

Our source of shared randomness is expressed through the function a : Z+ [0, 1], where ct(^) is the probability 
that Alice and Bob share the state ^, and normalization requires 

oc 

J2<j{o^i- (5) 

To obtain absolute bounds on the performance of classical strategies, we allow Alice and Bob to share arbitrarily large 
amounts of randomness, or equivalently, we allow Alice and Bob to choose a. The triple (p, q, r) is then referred to as 
a strategy with .shared randomness. If, however, Alice and Bob are instead constrained to use a particular distribution, 
(7, we will call the triple (p, q, r) a strategy with shared randomness a. Finally, we call {p, q, r) a strategy without shared 
randomness whenever both Alice and Bob use strategies that are independent of ^. 

Given a strategy (p, q, r) with shared randomness a, the probability that Roger outputs 1 when Sapna deals x to 
Alice and y to Bob is 

oo m 

P[^^''^^\x,y) E P{a\x,i)q{b\y,Or{a,b)o{0 • (6) 



5=1 a, 6=1 



Defining the error probability 



" ^"''^-\P^--^(x,y), x^y ^ 

the worst- case error probability is then simply the largest error probability that Sapna can coerce 

Fy,f)^max P^'''^)(x,y), (8) 
x,y 

and an optimal strategy is one that results in the smallest possible worst-case error probability, solving the minimax 
problem 



mm max 



p,q,r x^y P,Q,^ 

A strategy is said to have one-sided error when 



P^P'^'^\x,y)=mm PiP'r^ . (9) 



P^P'''''-\x,x) = l (10) 
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for all X. Using such a strategy, it is impossible for Roger to announce when Sapna has supplied Alice and Bob with 
identical messages. For the current investigation we consider only one-sided-error strategies. 

To begin, let us introduce a lemma that allows the following simplification. Whereas Roger can use a probabilistic 
strategy r, we show that there exists a deterministic strategy r' for Roger that is at least as good as all probabilistic 
strategies. 

Lemma 1. Let {p-,q,r) be a fingerprinting strategy with shared randomness a and one-sided error. Then 

P^'''''Hx,y) > P^«''^')(x,2/) (11) 

for all X and y, where 

r'ia b) i Pi'^l^i > '^"■^ > for some x and ^ 

^ ^ ' 1 0, otherwise ' 

Proof. Given a particular p and q, to satisfy the one-sided-error constraint [Eq. Hl()|l ] we must necessarily have r(a, b) = 
1 whenever there is an x and ^ such that p{a\x, ^) > and q{b\x, ^) > 0. Our goal is to now minimize Pi{x, y) whenever 
X ^ y, and thus, setting r(a, 6) = in the remaining cases is optimal. □ 

Lemma fallows us to limit our search for optimal one-sided-error strategies to the class where Roger's decisions 
are given by Eq. (|12|l . and are thus purely deterministic. Define the quantity 

^fe...)^^pfe..r)(^^y)^ (13) 

This quantity, for deterministic one-sided-error strategies with no shared randomness, is the total number of message 
pairs (x, y) that produce an error. For more general strategies the quantity ivi'''^''^-' can be used to derive bounds on 
the worst-case error probability. 

Lemma 2. Let {p,q,r) be a fingerprinting strategy with shared randomness a and one-sided error. Then there exists 
a deterministic fingerprinting strategy, {p',q',r'), without shared randomness but with one-sided error, such that 

^jp,?,'-) > 7V,(f . (14) 



Proof. First replace Roger's strategy, r, by the deterministic strategy, r' [Eq. (|12|l ]. Then by Lemma^ 

N^P-'i-^-') > TVjP''?''-') . (15) 

Now define the strategies without shared randomness, {p^,q^,r'), by setting p^{a\x) = p{a\x,^) and g^(a|x) = 
q{a\x,£,) for each ^. Then 

^iP.^y) ^ ^ivif«^'?«''-')a(0 > miniVe^^^-'^''"'^ = ^^(Pj'^V.'-') ^ (16) 

where (p^', q^', r') is a strategy without shared randomness which achieves the minimum. 

The functions p^i and g^' are probabilistic private strategies without shared randomness. Under the normalization 
constraint [Eq. Q], the set of all such private strategies is convex and compact. The extreme points of this set are 
precisely the m" different deterministic strategies. Since any member of a compact convex set can be rewritten in 
terms of a convex combination of the extreme points, any probabilistic strategy can be rewritten in terms of a convex 
combination of deterministic strategies. Specifically, we can rewrite Alice's and Bob's strategies as 

p^,{a\x) =^(j)^p^{a\x) and q(^,(b\y) = ^ejqj{b\y) , (17) 

i 3 

respectively, where 4>i, 6j > 0, (f)j — 6j = 1, and the strategies pi{a\x) and qj{b\y) are deterministic. Alice and 
Bob may now enact the strategy {p(^' , q^' ,r') by each flipping private coins to determine which i and j to use before 
Sapna deals {x,y). The probability that they choose pair {i,j) is then (j)iOj, and 

^bs',«5'/r') ^ (j)^0jMP''^^y) > min A^^P"'?^'''') = N^P''i'y) , (18) 

where {p',q',r') is a deterministic strategy that achieves the minimum. Combining inequalities H15|l . Hlt)|) and p8|) 
completes the proof. □ 
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Lemma |5] implies that neither private nor shared randomness is needed for the minimization of Nq^''^'^^ . A de- 
terministic fingerprinting strategy without shared randomness wih suffice. In the following lemma we give such a 
strategy. 

Lemma 3. Let (p, q, r) be a deterministic fingerprinting strategy without shared randomness but with one-sided error. 
Then 

]\liP,q,r) > k\n/mY + {m-k)[n/m\^ -n (19) 

where k — n mod m. Furthermore, equality holds for the strategy with 

, , . r/ . \ J / I \ /IN f 1, i/ a — 1 = X - I mod m 

r{a,b) = 6{a,b) and p(a\x) = q{a\x) = < ^ otherwise ' ^ ^ 



Proof. By Lemma ^ under the one-sided error condition it is optimal for Roger to employ the deterministic strategy 
given by Eq. I|12(l . Assume this to be the case for the remainder of the proof. 

Suppose Alice and Bob also employ deterministic strategies; they translate every incoming message to a specific 
fingerprint. Their joint strategy may be described by a pair of many-to-one maps drawn from the set of m" different 
fingerprinting functions of the form / : {l,...,n} — > {l,...,m}. Specifically, p{a\x) = (5(/^^^ (cc), a) and q(b\y) = 
5{f'''^\y),b) where /^^^ and /^'^ are Alice's and Bob's fingerprinting functions, respectively. Roger's strategy is thus 



r{a,b) 



1, if f'-P^x) = a and f'^''\x) = b for some X 
0, otherwise 



(21) 



Define the message sets 



M!f^^[x\f^P\x)^a} 



M, 



(9) _ 



(22) 



which contain all messages mapped to Alice's fingerprint, a, and Bob's fingerprint, fo, respectively. The quantity 



Sab 



counts the number of equal message pairs {x, x) mapped to fingerprint pair (a, 6), and likewise 



dab 



M, 



(9) 



Sab 



(23) 



(24) 



is the number of unequal message pairs {x,y) mapped to fingerprint pair (a, 6). Notice that, since both {Ma^^Ya^i 
and {Af^^^^l^j^ form set partitions of {1, . . . , n}, we have the following relations 



^Sab = 



M, 



(9) 



J2sab = 



Y^Sab 



(25) 



a,b 



and hence 



dab 



(^Y^SatSjbj ~ Sab ■ 



The total number of message pairs {x,y) that produce an error is then 



(26) 



= ^ dabr{a, fe) = ( I] SarSjb sgn(sab) J -n = F{ 

a,b \ a,b.i,j / 



s) — n 



(27) 



where Roger's strategy is now expressed as r{a,b) — sgn(sab) to emphasize the explicit dependence on the matrix s. 
The convention sgn(O) = is used for the signum function. 
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We now minimize F{s) over all m x m matrices s with nonnegative integer entries, subject to the constraint 
X^a b^a-b — T^- First notc that we may assume s is diagonal. If it were not, we could define the diagonal matrix s' 
with nonzero entries s^^j = Saj and the property 

Fis')= E <^^',bSgn{s',b) = E^aa' (28) 
a,b,i,j a 

^ E ^liSab (29) 

a,b,i 

= ^SaiSabSgn{Sab) (30) 

a,b,i 

< ^ SaiS-ibSgn{Sab) = F{s) . (31) 
a^bji.j 

For s diagonal, the minimum of F{s) — J^a '^aa^ under the constraint J^a ^aa — n clearly occurs when Saa — \n/ni\ 
for k entries, and Saa — [n/m\ for m — k entries, and thus, the number of message pairs which produce an error is 
bounded below by the RHS of Eq. p9ll . To complete the proof it is trivial to check that the inequality saturates 
under the given strategy [Eq. □ 

The above three lemmas allow us to prove our main result in a straightforward fashion. 

Theorem 4. Let (p, q, r) he a fingerprinting strategy with shared randomness and one-sided error. Then 

p(p,q,r) > fc \n/m\ ^ + {m-k) [n/m\ ^ - n 

where k — n mod m. Furthermore, equality holds when Alice and Bob use the deterministic strategy of Lemma\^ 
after applying a completely random permutation to the labels of Sapna's messages through the shared randomness. 
That is, they use the strategy with 

r{a, b) = 5{a, b) and p{a\x, £) = q{a\x, C) = { J; f^g^^L^ ^^""^^ '""'^ (33) 

where tt^ is one of n\ different permutations of Sapna's message labels, and (t(^) = l/n\ for 1 < ^ < ?i! (and zero 
otherwise), is chosen for the shared randomness. 

Proof. From Eq. H13|) the average error probability of a one-sided-error strategy, taken over all unequal message pairs, 
IS given 

by ivi^'^-'V ("'-")• This average error probability provides a lower bound for the worst-case error probability. 
Thus, by Lemmas El and 01 we have 

p(P,,,r) . ^i"^^-''^ . k\nlmY + {m-k)[n/m\^-n 

-'wee — 9 — ? ■ V'^^J 

The first inequality saturates if Alice and Bob apply a random permutation to Sapna's message labels immediately 
after x and y are dealt; the second saturates if they follow this permutation by the deterministic strategy of LemmaO 
[Eq. EOl- □ 

Note that no private randomness is needed for the optimal strategy. In all of the above we have assumed that Alice 
and Bob are the only parties allowed access to the random source a. When we also grant Roger access, replacing r{a, b) 
by r(a, 6,^), straightforward adjustments to the above proof show that Eq. H32|l again applies. If however, Sapna is 
also granted access, it is obvious that our fingerprinting scenario will revert to one without shared randomness. Note 
that if the value of ^ is announced publicly at set intervals, Alice and Bob may always deny Sapna knowledge of ^, 
by simply using only those values announced after x and y are dealt. 

We can investigate the classical communication complexity of fingerprinting with shared randomness by considering 
cases where equality holds in Eq. H32|l . Then Pwco < l/m, and consequently, log2(l/e) = 0(1) fingerprint bits are 
sufficient to keep Pwco < e for any small fixed e > 0. Defining the number of message and fingerprint bits, N = log2(n) 
and M = \og2{m), respectively, we see that the above optimal protocol [Eq. (jSSJ] requires log2(n!) = 0{2^ N) bits 
of shared randomness. By discarding repetitions in the set of n! deterministic strategies implicit in Eq. H33|) . we can 
reduce this to log2(n!/[([^n/m]!)''([n/mJ!)™~''(TO - /c)!fc!]) = 0((2^ - 2*^)M) bits of shared randomness, but this 
is still hugely excessive. If we relax the condition of strict optimality to strategies which simply keep the number of 
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fingerprint bits 0(1) in message size, and the error arbitrarily small, only 0(log(A^)) bits of shared randomness will 
sufhee Hinill^. 

Finally, we remark that if Bob is given a larger set of fingerprints, the minimum achievable worst-case error 
probability remains the same. In fact, in the general case where Alice has ruA fingerprints and Bob has ms fingerprints, 
Theorem 0] applies if we set m — min{r7i^,mB} throughout. We can show this as follows. First note that Lemma 
Hand El are unaffected by the generalization. To generalize Lemma 01 we need only consider the special case where 
ruA = m < n = ruB- For deterministic strategies with jub = n, without loss of generality, we may set q{h\y) = S^y 
so that Bob simply passes on Sapna's message to Roger. Lemma ^ then implies that the optimal choice for Roger's 
strategy is r(a, y) — p{a\y). The total resulting strategy (p, q, r), however, is now equivalent to the strategy (p', g', r'), 

where p'{a\x) = q'{a\x) = p{a\x) and r'{a,b) = 6ab, in that Pc^''^'^\x,y) = Pc^ '"^ \x,y) for all x and y. Note that 
the strategy (p', g', r') makes no use of Bob's additional fingerprints m < h < tub, and hence, we have shown that it 
is possible to convert deterministic strategies with the parameters tua — ni < n ~ tub to those with niA = ms ^ m 
without changing the error rate. Consequently, Lemma must also apply to the special case niA = m < n = wlb, 
and given that the minimum possible value of ivi^'*''^'* cannot decrease when tob is decreased. Lemma (31 applies to the 
general fingerprinting scenario if we set m = m\n{mA, nis} throughout. Theorem^now follows but with all cases of 
m replaced by Tiiin{mA, ms}- 



III. QUANTUM STRATEGIES WITH SHARED ENTANGLEMENT 

In the quantum scenario we replace Alice's and Bob's classical fingerprints (a and b) and probability distributions 
[p(a|a;, ^) and q{b\y, ^)], by quantum states, p{x, a) and f(?;, a) respectively, of an m-dimensional Hilbert space, denoted 
by Tirm and the shared randomness (t(^) by an entangled quantum state a of the tensor-product space Ti-dA ® ^dfsj 
where Ti^^ belongs to Alice and Tid^ to Bob. In the following analysis, all such quantum states will be pure. In 
correspondence with the classical scenario, we can either restrict Alice and Bob to use a particular given o", calling a 
protocol satisfying this constraint a strategy with shared entanglement a, or grant them any choice of entangled state, 
in which case we simply say the protocol is a strategy with shared entanglement. Being a pre-established component of 
the fingerprinting apparatus, Sapna will be allowed knowledge of cr, just as she is allowed knowledge of the probability 
distribution cr(^) in the classical scenario. For the tensor-product space Hd^Ti-d {dA ~ dB = d), define the maximally 

entangled quantum state = '^"^^^ X]fc=i \^)a ® \k)B, where \k)A and are basis states for Alice and Bob 

respectively. In the following, Alice and Bob use the same computational basis, in which case we drop the subscripts. 
Our first result shows that whenever n < rr? error- free quantum fingerprinting strategies exist. 

Theorem 5. When n < m? there exists an error- free quantum fingerprinting strategy with shared entanglement 

Proof. Let {Ux}^li be an orthonormal unitary operator basis for End(7i,„), the space of linear operators acting on 
Hrn i.e. tr [C/JC/y] — ui6xy. For example, we could use the operators defined by Eq. l|39l) below with n — ttz^. 

Upon receipt of Sapna's messages x and y, Alice and Bob perform on their portions of | '(/'+"■') the unitaries U* 
and Uy, respectively, where conjugation is done in the computational basis, and pass the resulting state on to Roger. 
Noting that 

C/.lA™^> - -E(^|f^-lj')*(^|f^^l^') = -Y.(^Pl\k)(k\Uy\j) = ltr[ulUy]=5xy (35) 

YT'h TYlj T7~h 

j-k j,k 

we find that the state received by Roger remains equal to |V-'+"^) when x — y, and orthogonal to when x ^ y. 

With the projective measurement jPi = -fo = 1 ^ -Pi}, Roger faultlessly determines F,Q{x,y). □ 

Notice that without classical communication, Alice and Bob cannot convert log2 m (or more) entangled qubits into 

the maximally entangled quantum state, l^/'^"'') (but both quantities can be converted into logj m privately shared 
random bits). In the classical case, however, Alice and Bob can convert a into approximately '^(^cr(^)log2<7{^) 
uniformly random bits, and vice versa, by simply agreeing to a pre-established formula. Thus shared randomness is 
an interconvertible resource, whereas shared entanglement is not. 

The quantum fingerprinting protocol used for the proof of Theorem |S1 may be extended to cases where n > by 
means of a straightforward reformulation of the classical strategy described in the beginning of Section m with the 
number of groups now being rather than m. The error rate of this protocol is given by 

k\n/ni?Y + {rri^ — k)\n/r}n?\'^ — n 

-'wee — ^ 7 
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where k = n mod m? . 

An improved error rate can be achieved using the foUowing approach. For each e > we evaluate how many unitary 
operators Ux we can construct with the property Ylx y [Ux^y] \ < e. It can be shown that 

n 

\tr{ElEy)f>n' (37) 

x,y=l 

for any set C End(7Ym) of n > rrv^ hnear operators with normahzation tT{ElEx) = m for all x [Tsl IT^. 

The proof of the following theorem relies on the existence of a set of unitary operators achieving this bound. Note 
that when n — Im^, where / is a positive integer, the error rates of Eq. H36|l and Eq. H38|l below coincide. This is a 
consequence of the fact that / copies of an orthonormal unitary operator basis will saturate the inequality [Eq. (|37|) ]. 

Theorem 6. When n > iv? there exists a quantum fingerprinting strategy with shared entanglement a ~ 
I V'^''' )(■'/'+" ^ I ® 1; fl^*^ worst-case error probability 

n/m? — 1 

"wco = ; — • (38) 



Proof. For n > iv? define the set {Ux}^^i C End(7im) of unitary operators with matrix components 



{j\Ux\k) = ^exp 



2'Kijk 2T:i{j + mk)x 



(39) 



where now i = -s/— T. When n = m^, {Ux}x=i forms an orthonormal unitary operator basis, and in general, a tight 
unitary operator frame is simple to verify unitarity of the operators. 



{j\uiUx\k) = ^(;|c/,br(w.ifc) = -E^^p 



1=1 



1=1 



2'Ki{k ~ j)l 2TTim{k ~ j)x 



m 



orthogonality when n = rn^ 



ir[UlUy\ - m.\kY{j\Uy\k) 

3,k=l 



exp 



= - E 

hk=l 

= — E*^^p 



27ri(j + mk){x — y) 



1=1 



Jxy , 



2'Ki(l + m)(x — y) 



and that 



n m 



E \^'Huy]\ -EE {j\Ux\kr{j\Uy\k){p\Ux\q){p\Uy\qr 

x,y—l x,y—l j,k,p,q—l 

_ J_ ^ \27Ti{p- j -\-m{q~k)){x-y) 

w? ^ ^-^P 

x,y—l j,A:,p,g— 1 

2 

" E = 

j,k,p,q=l 



(40) 

(41) 
(42) 

(43) 
(44) 

(45) 
(46) 
(47) 



provided n > rr? . 

To achieve the above worst-case error probability [Eq. (|38|l ] , Alice and Bob first convert the maximally entangled 
state 1^'+''') into a uniformly distributed shared random variable ^ G through local measurements in the 



9 



computational basis. They now use ^ to jointly choose ttj, one of n! different random permutations of Sapna's message 
labels. The second maximally entangled state, |V'+"^), is used in manner similar to Theorem^l Alice and Bob perform 
the local operation U*^i^^-^ ® ^T^dv) where Ux is now defined as in Eq. Ip!?^ . and send the result to Roger. 

Roger performs the projective measurement {^'i = | '</'+"'') 1 1 -Po — 1 ^ A}, revealing result 1 with probability 



x^y \ x,y / 



when X ^ y, and result 1 with probability 



r^Vm^ (48) 



^E|(VA"V:,(.)«C/.,(.)l^r)f - I (^Y.\'^[UlUx]\') = 1 (49) 

X \ X / 

when X = y. Thus, the protocol has one-sided error and a worst-case error probability given by Eq. (|38|l . □ 

IV. CONCLUSION 

To summarize, we have derived the minimum achievable worst-case error probability for classical fingerprinting 
protocols with one-sided error and an arbitrary amount of shared randomness. This is our main result and the content 
of Theorem 01 Furthermore, we have presented entanglement-assisted quantum fingerprinting protocols (Theorems [3 
andlHl with error rates surpassing the best classical protocols. We hope that our work provides some important new 
results applicable to current experimental investigations of quantum fingerprinting protocols [l^ IT^ . 

Our analysis is by no means complete. Future research directions might include: deriving the minimum achievable 
worst-case error probability for entanglement-assisted quantum fingerprinting protocols, investigating the required 
amount of shared randomness/entanglement necessary to execute fingerprinting protocols, or deriving error bounds 
for fingerprinting protocols with two-sided error. 

The absolute limits of successful fingerprinting protocols provide quantitative measures for the compressibility of 
information stored in message strings. Our analysis may be appended to the growing list which reveal a fundamentally 
greater capacity to compress data stored as quantum information. 
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